Privacy Notice
Version 2026-09-13.1
1. Who is responsible for your information
Hotspot Cards is operated by Kyle Pawlaczyk, who is the data controller for personal information processed through this service. For privacy questions or to exercise your data protection rights, contact kyle.pav@midlandsdesignservices.co.uk.
2. Who this service is for
Hotspot Cards is intended for people aged 18 or over. You must confirm that you are at least 18 when registering. The service is not intended to knowingly collect personal information from children.
3. Information we collect
- Account details: username, first name, last name, email address and password credentials.
- Contact and registration details: postal address, postcode and telephone number.
- Account-security information: email-verification status, password-reset tokens, registration date, last-login and last-active timestamps.
- Room and game information: room memberships, join requests and decisions, table activity, game participation, winners, deck count, scores and leaderboard statistics.
- Chat content: messages you choose to send within a room and the username attached to them.
- Administrative and security records: records of relevant administrator actions and technical information needed to operate, secure and troubleshoot the service.
Passwords are not stored in readable form. The service stores a one-way password hash. Private profile fields such as name, address, postcode, telephone number and email address are encrypted at rest.
4. Where we get the information
Most information is provided directly by you when you register or use Hotspot Cards. Game, room, login and activity information is generated through your use of the service. When you verify a postcode, only the postcode entered is sent to the postcode-validation provider so that the service can check whether it is a recognised UK postcode.
5. Why we use your information and our lawful bases
| Purpose | Information used | Lawful basis |
|---|---|---|
| Create and operate your account, authenticate you, provide rooms, games, chat, scores and leaderboards. | Account details, room/game activity and relevant technical/session information. | Contract — processing is necessary to provide the service you ask to use and to perform the Terms of Use. |
| Confirm your email address and send password-reset or essential account messages. | Name, email address and security tokens. | Contract and, where appropriate, legitimate interests in keeping accounts secure and recoverable. |
| Validate that a submitted postcode is a genuine UK postcode and support registration integrity. | Postcode. | Legitimate interests in reducing obviously false registrations and maintaining service integrity. |
| Maintain account records, administer room access, investigate misuse, prevent abuse, protect the service and troubleshoot faults. | Account/contact details, activity records, room records, audit/security information. | Legitimate interests in operating a secure, reliable and appropriately administered service. |
| Meet applicable legal obligations or respond to lawful requests. | Only information reasonably necessary for the relevant obligation or request. | Legal obligation where UK law requires the processing. |
We do not treat your acceptance of the Terms of Use or acknowledgement of this Privacy Notice as blanket consent to process your information. If we introduce a separate activity that legally requires consent, we will ask for that consent separately.
6. Registration information and address checks
Your postcode is checked against the free Postcodes.io service. The postcode check confirms that the postcode is recognised; it does not prove that you live at the address you enter. Your full street address is entered manually and is not sent to Postcodes.io by Hotspot Cards.
7. Who can see your information
Other users who can access the same room can see your username and information that is part of normal room/game interaction, including the room's retained chat messages, game status and leaderboard results. Chat messages may therefore remain visible to room members after you leave the table, until they fall outside the room's 500-message retention limit or the room is permanently deleted. Other users are not given access to your private registration profile such as your name, postal address, telephone number or email address.
The master administrator can access private registration information where necessary to administer accounts and the service. Passwords cannot be viewed by the administrator because only password hashes are stored.
8. Service providers and sharing
- Microsoft 365 / Microsoft Graph: used to send email-verification, password-reset and other essential account emails. The recipient email address, limited account information included in the message, and message content are sent to Microsoft for email delivery.
- Postcodes.io: used only to validate the UK postcode entered during registration or testing. Hotspot Cards does not send your full street address, name, phone number or email address to Postcodes.io for this check.
- Technical/service providers: information may be disclosed where reasonably necessary to host, maintain, secure or troubleshoot the service, subject to appropriate access controls.
- Authorities or professional advisers: information may be disclosed where required by law, to establish or defend legal rights, or to protect users, the operator or the service from fraud, abuse or security threats.
We do not sell your personal information and we do not use your registration information for third-party advertising.
9. International transfers
Some suppliers, including Microsoft, may process information outside the UK. Where personal information is transferred internationally, the transfer must be covered by an applicable UK adequacy regulation or appropriate safeguards recognised under UK data protection law, such as contractual transfer safeguards. Supplier arrangements may change over time, so current transfer information can be requested from the administrator.
10. How long we keep information
- Account and private profile information: kept while your account remains open and needed to provide or administer the service. If you ask for your account to be deleted, information will be deleted or anonymised where appropriate, unless it must be kept for a legitimate security, dispute or legal reason.
- Email-verification links: expire after 24 hours. Password-reset links: expire after 30 minutes. The service stores hashed token records rather than the usable link token itself.
- Room memberships and join-request records: kept while needed to operate the relevant room or administer access. Deleting a room removes its membership and join-request records.
- Game and leaderboard history: retained while needed to provide room and master leaderboard/history features. If an administrator permanently deletes a room, that room's stored game results are deleted and are removed from master leaderboard calculations.
- Room chat: room chat is stored in the service database so recent conversations remain available after server restarts and software updates. Hotspot Cards retains only the 500 most recent chat messages per room; when a new message takes a room above that limit, the oldest message is automatically deleted. Permanently deleting a room also permanently deletes that room's stored chat messages.
- Security and administrative records: retained only for as long as reasonably necessary for security, accountability, troubleshooting or legal purposes, and reviewed periodically.
We will not deliberately keep identifiable personal information indefinitely where there is no continuing need for it.
11. Security
Hotspot Cards uses measures designed to protect personal information, including encrypted private profile fields, one-way password hashing, HTTPS for the public service, access controls, CSRF protection, restricted administrator functions and server-side storage of encryption credentials/secrets. No online service can guarantee absolute security, but access is limited according to the functions a user or administrator needs.
12. Cookies and local device storage
Hotspot Cards uses a first-party session cookie that is necessary for sign-in, maintaining your authenticated session and protecting requests against misuse. It is used to provide the service you request rather than for advertising or behavioural tracking. Hotspot Cards does not currently use analytics or advertising cookies.
13. Automated decision-making
Hotspot Cards does not use solely automated decision-making or profiling that produces legal or similarly significant effects. Automated game rules, inactivity removal, postcode validation and security checks are functional parts of the service and do not make legal or similarly significant decisions about you.
14. Your data protection rights
Depending on the purpose and lawful basis, you may have rights to:
- ask for a copy of your personal information;
- have inaccurate or incomplete information corrected;
- ask for information to be erased in applicable circumstances;
- ask for processing to be restricted in applicable circumstances;
- object to processing based on legitimate interests;
- receive certain information you provided in a portable format where the right to data portability applies; and
- complain about how your information has been handled.
To exercise a right, email kyle.pav@midlandsdesignservices.co.uk. We may need to verify your identity before responding. Data-protection requests are normally answered within the timeframe required by UK law.
15. Complaints
Please contact the administrator first if you have a privacy concern so that it can be investigated. You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint.
16. Is providing the information compulsory?
The fields marked as required during registration are required to create a Hotspot Cards account under the current service design. If you do not provide them, an account cannot be created. You are not under a statutory obligation to register for or use Hotspot Cards.
17. Changes to this notice
This notice may be updated if the service, suppliers, legal requirements or processing activities change. Material changes will be brought to registered users' attention where appropriate, and the version/date shown above will be updated.